GH-200: GitHub Actions

Exam at a glance

Exam code

GH-200

Minutes

100

Passing score

700

Skill areas

5

Validity

2 yrs

Retake after

24 h

What the exam validates

GH-200 validates that you can automate software delivery with GitHub Actions end to end: write workflows and actions, read what a run did from its configuration and logs, run Actions at organisation and enterprise scale, and keep it secure and economical. It is a reading exam as much as a recall exam — most questions show a workflow, an action.yml, a log or a settings page and ask what happens, what is wrong, or which key fixes it. Expect to evaluate ${{ }} expressions in your head, expand matrices, follow needs: chains and spot the injection risk in a run: line.

Skills measured

Two skills carry up to a quarter of the exam each: authoring workflows and managing Actions for the enterprise. Consuming and troubleshooting workflows and authoring actions sit in the middle, and security and optimisation is the lightest — though security thinking (least privilege, pinning, injection) runs through every other skill. The skills below run in study-guide order.

1. 1. Author and manage workflows

   20–25%

   Triggers and inputs, jobs and conditions, needs, service containers, matrices, YAML anchors, contexts and expressions, caching, artifacts, outputs, environment files, job summaries, badges and environment protections.
2. 2. Consume and troubleshoot workflows

   15–20%

   Reading triggers from configuration and logs, diagnosing failed runs, expanding anchors, matrix variants and re-runs, logs and artifacts in the UI and API, workflow templates against reusable workflows and composite actions, disabling and deleting.
3. 3. Author and maintain actions

   15–20%

   JavaScript, Docker container and composite actions, action.yml metadata and directory layout, workflow commands inside actions, troubleshooting, distribution models, publishing to the Marketplace and release strategies.
4. 4. Manage GitHub Actions for the enterprise

   20–25%

   Reusable components and templates, access to actions and workflows, use policies, GitHub-hosted and self-hosted runners, runner groups, networking and IP allow lists, preinstalled software, and secrets and variables at every level.
5. 5. Secure and optimize automation

   10–15%

   Environment gates, trustworthy actions, script injection, GITHUB_TOKEN permissions against PATs, OIDC federation, SHA pinning and lockfiles, action policies, artifact attestations, and caching, retention and scaling for cost.

Bars are drawn to scale against the largest possible weighting, 25%.

Start here and final review

A workflow run in one picture

Almost every GH-200 question sits somewhere on this graph. An event starts a workflow run; its jobs run in parallel on fresh runners unless needs: chains them; each job's steps run scripts or actions in order on the same machine. If you can say which box a key belongs to, you can usually eliminate half the answers.

flowchart LR
  EV["Event<br/>push · pull_request · schedule · workflow_dispatch"] --> WF["Workflow<br/>.github/workflows/*.yml"]
  WF --> BUILD["Job: build<br/>runs-on: ubuntu-latest"]
  WF --> LINT["Job: lint<br/>runs-on: ubuntu-latest"]
  BUILD --> DEPLOY["Job: deploy<br/>needs: [build, lint]<br/>environment: production"]
  LINT --> DEPLOY
  class BUILD,LINT success
  class DEPLOY pending

Suggested study order

flowchart TB
  F["Actions Foundations<br/>events · jobs · steps · runners"] --> S1["Skill 1 · Author workflows<br/>20–25%"]
  S1 --> S2["Skill 2 · Consume and troubleshoot<br/>15–20%"]
  S1 --> S3["Skill 3 · Author actions<br/>15–20%"]
  S2 --> S4["Skill 4 · Enterprise and runners<br/>20–25%"]
  S3 --> S4
  S4 --> S5["Skill 5 · Secure and optimize<br/>10–15%"]
  S5 --> REF["Syntax reference"]
  REF --> TIPS["Exam tips and caveats"]

The official learning path

Course GH-200T00-A, Automate your workflow with GitHub Actions, is a one-day instructor-led course. Its self-paced content is a two-part learning path of seven Microsoft Learn modules. Read each alongside the skill page it maps to — and note that the modules predate the January 2026 rewrite, so several of the newer bullets (YAML anchors, service containers, attestations, OIDC, retention APIs) are only in the documentation.